From a73c96976d6d386b12f054c3bb0be7f70f152afc Mon Sep 17 00:00:00 2001 From: subhashree-sahu31 Date: Wed, 18 Feb 2026 16:47:18 +0530 Subject: [PATCH] feat: Adding redirection changes for enterprise users (#134) * feat: Adding redirection changes for enterprise users * fix: removed request from the waffle flag arguements (cherry picked from commit 2e2ea9a14eefe408e0bbd87bf31345f049b7fa21) --- .../djangoapps/user_authn/config/waffle.py | 18 ++++++++++++- .../djangoapps/user_authn/views/login_form.py | 26 ++++++++++++++----- 2 files changed, 36 insertions(+), 8 deletions(-) diff --git a/openedx/core/djangoapps/user_authn/config/waffle.py b/openedx/core/djangoapps/user_authn/config/waffle.py index 3cbb0cb2e18b..ff753d230efe 100644 --- a/openedx/core/djangoapps/user_authn/config/waffle.py +++ b/openedx/core/djangoapps/user_authn/config/waffle.py @@ -2,7 +2,7 @@ Waffle flags and switches for user authn. """ -from edx_toggles.toggles import WaffleSwitch +from edx_toggles.toggles import WaffleFlag, WaffleSwitch _WAFFLE_NAMESPACE = 'user_authn' @@ -31,3 +31,19 @@ ENABLE_PWNED_PASSWORD_API = WaffleSwitch( f'{_WAFFLE_NAMESPACE}.enable_pwned_password_api', __name__ ) + +# .. toggle_name: user_authn.enable_enterprise_redirect_to_authn +# .. toggle_implementation: WaffleFlag +# .. toggle_default: False +# .. toggle_description: When enabled, allows Enterprise/B2B customers to be redirected to the AuthN MFE instead of +# the legacy Django login templates. This flag provides an incremental rollout mechanism for migrating Enterprise +# customers to the modern authentication experience. The flag has no effect on users with external authentication +# providers (SAML/TPA), who always remain on the legacy flow. B2C users are redirected to the MFE by default +# regardless of this flag. +# .. toggle_use_cases: opt_in +# .. toggle_creation_date: 2026-02-18 +# .. toggle_warning: This flag only affects Enterprise customers without external auth providers (SAML/TPA). +# Enabling this flag for an Enterprise customer with complex SSO requirements may break authentication flows. +ENABLE_ENTERPRISE_REDIRECT_TO_AUTHN = WaffleFlag( + f'{_WAFFLE_NAMESPACE}.enable_enterprise_redirect_to_authn', __name__ +) diff --git a/openedx/core/djangoapps/user_authn/views/login_form.py b/openedx/core/djangoapps/user_authn/views/login_form.py index 624259c9c3cf..90456e45d59a 100644 --- a/openedx/core/djangoapps/user_authn/views/login_form.py +++ b/openedx/core/djangoapps/user_authn/views/login_form.py @@ -25,10 +25,8 @@ from openedx.core.djangoapps.user_api.accounts.utils import is_secondary_email_feature_enabled from openedx.core.djangoapps.user_api.helpers import FormDescription from openedx.core.djangoapps.user_authn.cookies import set_logged_in_cookies -from openedx.core.djangoapps.user_authn.toggles import ( - is_require_third_party_auth_enabled, - should_redirect_to_authn_microfrontend, -) +from openedx.core.djangoapps.user_authn.config.waffle import ENABLE_ENTERPRISE_REDIRECT_TO_AUTHN +from openedx.core.djangoapps.user_authn.toggles import should_redirect_to_authn_microfrontend from openedx.core.djangoapps.user_authn.views.password_reset import get_password_reset_form from openedx.core.djangoapps.user_authn.views.registration_form import RegistrationFormFactory from openedx.core.djangoapps.user_authn.views.utils import third_party_auth_context @@ -202,10 +200,24 @@ def login_and_registration_form(request, initial_mode="login"): enterprise_customer = enterprise_customer_for_request(request) + # Check for external providers (SAML/TPA) which must NEVER redirect to MFE + has_external_provider = bool(tpa_hint_provider or saml_provider) + + # Determine eligibility based on segment + if enterprise_customer: + # Enterprise/B2B: Requires the specific rollout waffle flag + is_segment_eligible = ENABLE_ENTERPRISE_REDIRECT_TO_AUTHN.is_enabled() + else: + # B2C: Eligible by default + is_segment_eligible = True + + # Redirect to authn MFE if all conditions are met: + # 1. MFE is globally enabled (should_redirect_to_authn_microfrontend) + # 2. User segment is eligible (B2C by default, or Enterprise with flag enabled) + # 3. No external auth provider is present (SAML/TPA must use legacy flow) if should_redirect_to_authn_microfrontend() and \ - not enterprise_customer and \ - not tpa_hint_provider and \ - not saml_provider: + is_segment_eligible and \ + not has_external_provider: # This is to handle a case where a logged-in cookie is not present but the user is authenticated. # Note: If we don't handle this learner is redirected to authn MFE and then back to dashboard